Apache Answer: Repeated submission at registration created duplicate users with the same name

Vulnerability

CVE-2024-26578 is a race condition vulnerability in Apache Answer up to version 1.2.1, arising from improper synchronization during the user registration process. When users register, the system does not properly lock shared resources, allowing concurrent registration requests to create multiple accounts with the same username if submissions are made rapidly [1][2].

Exploitation

An attacker can exploit this by scripting rapid registration requests to the same username. This does not require authentication or special privileges, only network access to the registration endpoint. The attacker can create many duplicate accounts, potentially filling the database with identical usernames [2].

Impact

Successful exploitation leads to multiple user accounts sharing the same name, which can cause confusion, disrupt normal user management, and potentially be used to bypass rate limits or impersonation controls. This could degrade the platform's trustworthiness and complicate moderation [1][2].

Mitigation

The vulnerability is fixed in Apache Answer version 1.2.5. Users are strongly recommended to upgrade to this version immediately. No workaround is mentioned [1][2].